threat-model

Identify and mitigate security threats in system designs using STRIDE, DREAD, and PASTA.

53|1|Updated Dec 18, 2025

Search Tags:#STRIDE #risk #threat-model #DREAD #PASTA

Ready to run

npx skills add https://github.com/cosmix/claude-code-setup --skill threat-model

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: threat-model
Source: https://github.com/cosmix/claude-code-setup/tree/main/skills/threat-model
Command: npx skills add https://github.com/cosmix/claude-code-setup --skill threat-model

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Threat modeling provides structured methodologies (STRIDE, DREAD, PASTA) to identify, assess, and mitigate security risks early in the design phase.

Core Features & Use Cases

STRIDE Analysis: Systematically categorize threats by spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
DREAD Scoring: Quantify risk across damage, reproducibility, exploitability, affected users, and discoverability.
Threat Model Template: Guidance for scope, data flows, and mitigations with attack trees.

Quick Start

Create a threat model for a new API with STRIDE categories and a risk rating table.

Frequently Asked Questions about threat-model

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is threat modeling and when should I use it in system design?▼

Threat modeling is a structured methodology for identifying and mitigating security risks early in design. Use it during new system design, architecture reviews, feature additions, third-party integrations, and compliance assessments to systematically uncover vulnerabilities before deployment.

How do I conduct a STRIDE analysis for my system architecture?▼

STRIDE systematically categorizes threats across six dimensions: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Map each category against your system components and data flows to identify threat vectors comprehensively.

How do I quantify and prioritize security risks using DREAD scoring?▼

DREAD scoring quantifies risk by assessing damage potential, reproducibility, exploitability, affected users, and discoverability for each threat. This produces a numeric risk rating that prioritizes which threats demand mitigation first.

Can I use threat modeling for API security and data flow analysis?▼

Yes. Threat modeling supports API threat analysis through data-flow diagrams, asset identification, trust-boundary mapping, and attack tree construction. This guides you through scoping threats, identifying vulnerabilities, and planning risk-based mitigations.

What's the difference between STRIDE, DREAD, and PASTA threat modeling approaches?▼

STRIDE categorizes threats by attack type, DREAD scores risk numerically, and PASTA uses process-driven risk analysis. Choose based on your workflow: STRIDE for threat enumeration, DREAD for prioritization, PASTA for comprehensive process-centric assessment.

Do I need security expertise to build an effective threat model?▼

Threat modeling is most effective when structured templates, clear data-flow guidance, and systematic categorization frameworks reduce guesswork. STRIDE, DREAD, and PASTA provide that structure, making threat analysis accessible to architects and engineers with security awareness.